News for hackers. Stuff that matters.
Re:Local privilege escalation vulnerabilities in Linux by spartanatreyu on Thursday November 05, 2026 @06:11PM (#50385888)
> It’s a bad argument. AI isn’t single use. Current iteration of AI is already there and serving it is cheap.

I'm not sure what you're saying here, it doesn't seem related to what was said before.

---

> So you get great tool for detecting these issues in the future at low cost.

Detecting issues doesn't stop the issues getting created in the first place.

The goal should have always been to make the issues impossible in the first place.

> Without AI the cost wouldn’t really decrease with time.

The cost of what? AI has a front-loaded cost, just like producing better tooling.

> And also it costs me 200$ now to find these bugs. I don’t think I could hire software engineer for that much.

Tooling that prevents the bugs in the first place is effectively free once it has already been made.

Re:Local privilege escalation vulnerabilities in Linux by azan_ on Friday November 06, 2026 @10:55AM (#50393944)
I'll address only last point because everything else stems from that.

> Tooling that prevents the bugs in the first place is effectively free once it has already been made.

Surely you understand that such tooling is basically impossible to create and even if it was impossible it would be so horrendously expensive and hard to implement that AI would actually turn out to be cheaper. Under the false assumption that such tools could be produced you are right, but that assumption is absurd.

Re:Local privilege escalation vulnerabilities in Linux by spartanatreyu on Sunday November 08, 2026 @10:07PM (#50420535)
> Surely you understand that such tooling is basically impossible to create and even if it was impossible it would be so horrendously expensive and hard to implement that AI would actually turn out to be cheaper.

Looking at Microsoft's decades plus collection of security fixes, it was shown that ~70% of errors were related to memory mismanagement. Rust essentially nullified that category of errors and it was cheaper than producing LLMs.

Fuzzing was cheaper than producing LLMs.

Deterministic simulation testing (e.g. Antithesis) was cheaper than producing LLMs.

Formal verification was cheaper than producing LLMs

CHERIoT is cheaper than producing LLMs.

Even supercompiling was cheaper than producing LLMs.

And we have all this type/mutate/temporal/dataflow information in new languages/compilers etc... to prove we don't run into entire categories of errors.

Those hardware, software, theoretic dataflow models are cheaper than producing LLMs.

Put them all together and you have a verified secure platform to build from, and they'd still together be cheaper than LLMs.

And the alternative reality that received the funding that LLMs received in ours must be looking at us, and our code, the same way that we today look at code from the 70s.

It's fair to say that producing LLMs past just translating one spoken language to another spoken language has been a misallocation of resources.